🏅 DEFONEOS: MCP SEAL Eligibility Tracker

Per-MCP SEAL status. DEFONEOS-SEAL is the credential issued by the csoai-defoneos compartment (CERTIFIES) to MCPs that meet sovereignty, security, audit, and operational criteria. This page tracks the 30 MCPs across the meok-defoneos compartment (BUILDS) and shows each one's current SEAL-eligibility status, the criteria it satisfies, and the remaining gates.

🏅 SEAL Criteria (7)

An MCP becomes DEFONEOS-SEAL eligible when ALL 7 criteria are satisfied:

1. SBOM published. SPDX 2.3 SBOM bundle on www.csoai.org/sbom/ with Ed25519 signature from DEFONEOS release key. Freshness probe must return FRESH within 24h.
2. Red-line scan PASS. All 7 red-line vectors pass (US CDN / US root CA / US cloud API / US NTP / US telemetry / US-vendor JS / kinetic patterns). 30/30 PASS across the fleet; 210/210 vector checks PASS.
3. Compartment scope boundary declared. MCP must declare which of the 7 compartment scope boundaries it operates within. Cross-compartment references require explicit council approval.
4. Owner cosign on activation motion. The BFT council motion that promoted the MCP must carry R1 owner cosign. Without cosign, the motion is operationally valid but not SEAL-eligible.
5. Pen test cycle complete. At least one pen-test cycle (PT-YYYY-QN-CX) must have completed within the last 180 days, with 0 CRIT and 0 HIGH findings.
6. Witness set rotation up-to-date. The MCP's witness set must have rotated within the last 90 days (R4 monthly) or 180 days (R2/R3 quarterly / R5 semi-annual).
7. 33-agent BFT council vote (quorum 23/33). A standard 23/33 motion explicitly voting to issue SEAL to the MCP must pass. This is the final gate; until then the MCP is a candidate.

📊 Eligibility Status — 30 MCPs

🏅 Top Candidates (4)

🛡️ Red-Line Invariants (4 specific to SEAL)

🔗 4-Step Curl Verification

# Step 1: verify this page byte-exact
curl -s -o /tmp/verify.html https://www.csoai.org/defoneos-mcp-seal-eligibility-tracker.html
wc -c /tmp/verify.html
# Expected: 21000 bytes (±100)

# Step 2: verify SBOM index
curl -s -o /tmp/verify.html https://www.csoai.org/defoneos-sbom-index.html
wc -c /tmp/verify.html
# Expected: 22517 bytes

# Step 3: verify SBOM type breakdown
curl -s -o /tmp/verify.html https://www.csoai.org/defoneos-sbom-type-breakdown.html
wc -c /tmp/verify.html
# Expected: 20639 bytes

# Step 4: verify BFT minutes
curl -s -o /tmp/verify.html https://www.csoai.org/defoneos-bft-council-public-minutes.html
wc -c /tmp/verify.html
# Expected: 22327 bytes

🔗 Cross-Reference

• SBOM Index — 30 MCPs with SPDX 2.3 + Ed25519-signed SBOM bundle
• SBOM Type Breakdown — 30 MCPs categorised (10 sensor / 8 defence / 7 civil / 3 compliance / 2 core)
• SBOM Quarterly Trend — Q-over-Q growth chart
• BFT Council Public Minutes — 142 cumulative motions + voting thresholds
• Vote Tally by Quorum Threshold — drill-down by motion class
• Vote Tally by Ring — per-ring drill-down
• Red-Line Motions History — 38 red-line motions Q1-Q3
• Pen Test Summary — 12 test classes × 7 red-team scenarios
• Witness Rotation Policy — quarterly R2/R3 + monthly R4 + semi-annual R5
• Buyer Acceptance Test Plan — T1-T16 mapped to evidence domains D1-D11